Ensure private GKE nodes are configured without external IP addresses

So wird geprüft

Prüfmethode: Shell-Befehl

c=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(privateClusterConfig.enablePrivateNodes)') || exit 1
out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,networkConfig.enablePrivateNodes)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && $2!="True" {print $1}')
if [ "$c" = True ] && [ -z "$bad" ]; then echo compliant; else echo "noncompliant: cluster=$c pools:" $bad; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Remediate by enabling private nodes at the cluster level for new node pools and at the node pool level for existing node pools. Private nodes provision GKE nodes with internal IP addresses only. GKE does not automatically modify existing node pools when the cluster level setting is changed, so existing node pools must be updated separately. Enable private nodes as the cluster level default for new node pools: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias Enable private nodes on an existing node pool: gcloud container node-pools update $POOL_NAME \ --cluster $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias • Note: After remediation, rerun the audit commands and confirm that the cluster level default and each applicable node pool return ...

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target gke